Challenge
The main requirement for this project was to create a secure environment for working with Android applications. However, in the process of development we faced a number of challenges that needed to be overcome:
- different implementation of Android OS individual components on devices produced by various manufacturers
- a high number of data transfer mechanisms, both interprocess and general file/network I/O in Android OS, required for interception
- all interceptions and safe features were carried out without root rights on the device
- compatibility with all Android versions from 2.x to 4.x
- support and modification of third party products
- complicated testing process
- demanding and time-consuming debugging process of the isolated application
Solution
To deal with the challenges, we first conducted a thorough research and implemented a series of approaches. As a result, control over the necessary application was attained by:
- interception and the OS kernel function calls substitution
- interception of processor instructions
Network traffic control was also reached by intercepting system functions, parsing raw network packets and redirecting them to the secure tunnel with VPN server.
Furthermore, using certain peculiarities of the OS, we provided security when working with some of the most commonly used applications. We ensured that when using these applications, the data ended up in a secure group. This secure group involved the exchange of different data as I/O files, network communications and other IPC in encrypted form and only within this particular group. Any application could be added to such group via a web portal and within this group, the applications were able to:
- block/encrypt copying of any text into Android OS buffer
- block phone camera
- block application operation
- turn on authorization mechanisms
- delete personal data in case of unauthorized application use
- prevent from making screenshots
- establish VPN connection with a secure server and direct traffic of applications only from within this secure group
In the end, we managed to implement all the necessary client requirements, customized the product effectively and achieved a high level of user data protection from malicious applications and any unauthorized access.
